Upgrade to Pro — share decks privately, control downloads, hide ads and more …

EASM mistakes waiting to happen

Sponsored · SiteGround - Reliable hosting with speed, security, and support you can count on. →
Avatar for JR0ch17 JR0ch17
January 25, 2022
Technology
0
49

EASM mistakes waiting to happen

Avatar for JR0ch17

JR0ch17

January 25, 2022
Tweet

More Decks by JR0ch17

See All by JR0ch17
Traversing my way in the internal network
Avatar for JR0ch17 jr0ch17
0
170
Getting Started in Bug Bounty
Avatar for JR0ch17 jr0ch17
0
160
Getting Blindly Lucky
Avatar for JR0ch17 jr0ch17
0
94
Qu'est-ce que le bug bounty?
Avatar for JR0ch17 jr0ch17
0
140
Finding 5 bugs in a single parameter
Avatar for JR0ch17 jr0ch17
0
110
Beyond the Borders of Scope
Avatar for JR0ch17 jr0ch17
1
90
Bad API, hAPI Hackers!
Avatar for JR0ch17 jr0ch17
0
1.6k

Other Decks in Technology

See All in Technology
「静的解析」だけで終わらせない。 SonarQube の最新機能 × AIで エンジニアの開発生産性を本気で上げる方法
Avatar for Wenhan Shi xibuka
2
260
Claude Codeはレガシー移行でどこまで使えるのか？
Avatar for ak2ie ak2ie
0
710
ローカルでLLMを使ってみよう
Avatar for kosmosebi kosmosebi
0
180
器用貧乏が強みになるまで ～「なんでもやる」が導いたエンジニアとしての現在地～
Avatar for KAKEHASHI kakehashi
PRO
5
520
30分でわかるアーキテクチャモダナイゼーション
Avatar for nwiizo nwiizo
7
3.5k
AI駆動開発とRAGプロダクトへの挑戦の軌跡 - 弁護士ドットコムでの学びから -
Avatar for 弁護士ドットコム bengo4com
2
810
Oracle Cloud Infrastructure データベース・クラウド：各バージョンのサポート期間
Avatar for oracle4engineer oracle4engineer
PRO
57
47k
チーム開発の基礎_研究を事業につなげるために
Avatar for CyberAgent cyberagentdevelopers
PRO
8
4.3k
AI活用を"目的"にしたら、データの本質が見えてきた - Snowflake Intelligence実験記 / chasing-ai-finding-data
Avatar for pei0804 pei0804
0
450
「技術的にできません」を越えて価値を生み出せ──研究開発チームをPMが率いて生み出した価値創出
Avatar for Takahiro Yamaguchi hiro93n
1
310
【2026年版】生成AIによる情報システムへのインパクト
Avatar for Takaaki Yayoi taka_aki
0
170
サンタコンペ2025完全攻略 ～お前らの焼きなましは遅すぎる～
Avatar for terry-u16 terryu16
1
310

Featured

See All Featured
How to Talk to Developers About Accessibility
Avatar for Jason CranfordTeague jct
2
140
The Anti-SEO Checklist Checklist. Pubcon Cyber Week
Avatar for Ryan Jones ryanjones
0
81
Navigating the Design Leadership Dip - Product Design Week Design Leaders+ Conference 2024
Avatar for Andy Polaine apolaine
0
210
Redefining SEO in the New Era of Traffic Generation
Avatar for Szymon szymonslowik
1
230
How STYLIGHT went responsive
Avatar for nonsquared nonsquared
100
6k
CSS Pre-Processors: Stylus, Less & Sass
Avatar for Bermon Painter bermonpainter
360
30k
Measuring Dark Social's Impact On Conversion and Attribution
Avatar for Stephen Akadiri stephenakadiri
1
140
Future Trends and Review - Lecture 12 - Web Technologies (1019888BNR)
Avatar for Beat Signer signer
PRO
0
3.2k
技術選定の審美眼（2025年版） / Understanding the Spiral of Technologies 2025 edition
Avatar for Takuto Wada twada
PRO
117
110k
Become a Pro
Avatar for Speaker Deck speakerdeck
PRO
31
5.8k
Producing Creativity
Avatar for Steve Smith orderedlist
PRO
348
40k
YesSQL, Process and Tooling at Scale
Avatar for Rocio Delgado rocio
174
15k

Transcript

  1. EASM mistakes waiting to happen

  2. GET /whoami HTTP/2 Jasmin Landry JR0ch17 Lead, IT & Security

    at Montreal Canadiens fan

  3. GET /agenda HTTP/2 EASM Common mistakes Hacker perspective

  4. GET /EASM HTTP/2 What exactly is EASM? What does it

    cover? Why is it important?

  5. GET /common_mistakes HTTP/2 Lack of Change Management Not respecting Least

    Privilege Misconfigured WAFs Cloud misconfigs (S3 buckets)

  6. GET /hacker_perspective HTTP/2 • Subdomains • IPs • TLS certificates

    • Third-party apps Recon EVERYTHING • Monitor for new assets • Monitor any change Continuous Monitoring

  7. GET /thanks HTTP/2 Thank you for listening Questions? More questions?

    DMs are open on and